While âclassicalâ human identity has kept philosophers busy since millennia, âDigital Identityâ seems primarily machine related. Telephone numbers, E-Mail inboxes, or Internet Protocol (IP)-addresses are irrelevant to define us as human beings at first glance. However, with the omnipresence of digital space the digital aspects of identity gain importance. In this submission, we aim to put recent developments in context and provide a categorization to frame the landscape as developments proceed rapidly. First, we present selected philosophical perspectives on identity. Secondly, we explore how the legal landscape is approaching identity from a traditional dogmatic perspective both in national and international law. After blending the insights from those sections together in a third step, we will go on to describe and discuss current developments that are driven by the emergence of new tools such as âDistributed Ledger Technologyâ and âZero Knowledge Proofâ. One of our main findings is that the management of digital identity is transforming from a purpose driven necessity towards a self-standing activity that becomes a resource for many digital applications. In other words, whereas traditionally identity is addressed in a predominantly sectoral fashion whenever necessary, new technologies transform digital identity management into a basic infrastructural service, sometimes even a commodity. This coincides with a trend to take the âcontrolâ over identity away from governmental institutions and corporate actors to âself-sovereign individualsâ, who have now the opportunity to manage their digital self autonomously. To make our conceptual statements more relevant, we present several already existing use cases in the public and private sector. Subsequently, we discuss potential risks that should be mitigated in order to create a desirable relationship between the individual, public institutions, and the private sector in a world where self-sovereign identity management has become the norm. We will illustrate these issues along the discussion around privacy, as well as the development of backup mechanisms for digital identities. Despite the undeniable potential for the management of identity, we suggest that particularly at this point in time there is a clear need to make detailed (non-technological) governance decisions impacting the general design and implementation of self-sovereign identity systems.
We present a decentralised solution for managing scientific communication, based on distributed ledger technologies, also called blockchains. The proposed system aims to solve incentive problems displayed by traditional systems in scientific communication and publication. A minimal working model is presented, defining roles, processes, and expected results from the novel system. The proposed solution is viable, given the current status of blockchain technology, and should lead to a rethinking of current practices and their consequences for scientific communication.
Distributed ledger technology is one of the latest fintech innovations that could increase the efficiency of securities markets. The technology represents a new paradigm how the need of trusted third parties can be eliminated and how transaction cost can be lowered. The technology can be used as a platform for so-called smart contracts. The implementation of DLT and smart contracts is however not risk free, the technology is also at an early stage and it is still unsure whether it will overcome all hurdles. \n \nBefore the innovations can be utilized on a full scale, potential risk such as the uncertainty regarding the legal validity and enforcement of smart contracts needs to be eliminated, so that the technology can be implemented and used with a high level of predictability and trust. The research sets out to solve the research question from the view point of Finnish securities law, limiting the research to smart contracts in securities markets. General principles are deconstructed using international, European and Finnish sources to solve the legal problem. \n \nSmart contracts can be divided into blockchain smart contracts in crypto markets and smart contracts in securities markets, the research focuses on the latter. Smart contracts can also be divided into smart contract code and smart legal contracts. Smart contracts are defined in the research as agreements automatable by computer and enforceable by either legal enforcement of rights and obligations or by execution of code. Technology neutrality is set out as a central principle in regulating fintech. The research question is reframed as whether a contract concluded in code is valid and enforceable. By analysing electronic contracts, enforcement of code, the example of the vending machine and by teleologically interpreting the law, it is established that smart contracts concluded in code can be both legally valid and enforceable. \n \nValidity and enforceability from the perspective of securities law can also be seen as the execution of rights and the issuance of securities. Securities and securities markets also have special characteristics, such as being fungible, collective and anonymous. Securities markets are also already to a high degree automated, using electronic trading systems, where many securities exist only in electronic form, programming languages are also already used to express securities and their functions. Existing securities law, which is technology neutral, can therefore be applied on smart contracts in securities markets, without the need of any regulatory changes. The growing digitalisation and automation of securities markets raise however broader questions such as the elasticity of the law and its implications on the stability of the financial system.
Abstract We develop a theory of blockchain governance. In our model, the proof-of-work system, the most common set of rules for validating transactions in blockchains, creates an industrial ecosystem with specialized suppliers of goods and services. We analyze the interactions between blockchain governance and the market structure of the industries in the blockchain ecosystem. We show that the proof-of-work system may lead to a situation in which some large firms in the blockchain industrial ecosystemâblockchain conglomeratesâcapture the governance of the blockchain. Authors have furnished an Internet Appendix, which is available on the Oxford University Press Web site next to the link to the final published paper online.
In this research paper, blockchain-based trust management model is proposed to enhance trust relationship among beacon nodes and to eradicate malicious nodes in Wireless Sensor Networks (WSNs). This composite trust evaluation involves behavioral-based trust as well as data-based trust. Various metrics such as closeness, honesty, intimacy and frequency of interaction are taken into account to compute behavioral-based trust of beacon nodes. Further, the composite (behavior and data) trust value of each beacon nodes is broadcast to Base Stations (BS) to generate a blockchain of trust values. Subsequently, the management model discards the beacon node with least trust value and that ensures reliability and consistency of localization in WSNs. The simulated results of the proposed algorithm are compared with the existing ones in terms of detection accuracy, False Positive Rate (FPR) and False Negative Rate (FNR) and Average Energy Consumption (AEC).
Mobile crowdsensing (MCS) is an emerging data collection paradigm that exploits the potential of individual mobile devices to acquire mass data in a cost-effective manner. One of the important challenges in MCS application is to resist malicious users who provide false data to disturb the system. In the existing work, the reputation management scheme is an effective way to overcome the challenge. However, most reputation management schemes rely on a semi-honest server and process data in the plaintext domain without considering server security and user privacy. In this paper, we integrate the blockchain and edge computing in the MCS scenario to construct a credible and efficient blockchain-based MCS system, called BC-MCS. To resist malicious users, we present a privacy-preserving reputation management scheme based on the proposed system. Furthermore, we design a delegation protocol to solve the inherent problem of user dynamics in the MCS. The prototype system implemented on the Hyperledger Sawtooth and Android client demonstrates that our scheme can achieve higher utility and security levels in handling malicious users compared with the previous centralized reputation management schemes.
How Americans talk when they talk about #MeToo is often deeply rooted in the lawâeven in non-legal settings, participants in the #Me-Too conversation often deploy legal definitions of victims and perpetrators, reference legal standards of proof and the role of legal forums, draw explicit or implicit comparisons to legal punishments, and derive meaning from legal metaphors and legal myths. In this essay, I identify and assess the deployment of such law talk to help understand both how legal rhetoric may facilitate the national #MeToo conversation and related legal reforms, but may also simultaneously limit and obscure some of the #MeTooâs more transformative possibilities. Such critical engagement seeks to open space for selective pushback, including initial thoughts on the possibilities of reclaiming colloquial law talk to better match the interests at stake in non-legal settings as well as bringing to the forefront the therapeutic, informative, and structural issues law talk might crowd out.
In enterprise business applications, large volumes of data are generated daily, encoding business logic and transactions. Those applications are governed by various compliance requirements, making it essential to provide audit logs to store, track, and attribute data changes. In traditional audit log systems, logs are collected and stored in a centralized medium, making them prone to various forms of attacks and manipulations, including physical access and remote vulnerability exploitation attacks, and eventually allowing for unauthorized data modification, threatening the guarantees of audit logs. Moreover, such systems, and given their centralized nature, are characterized by a single point of failure. To harden the security of audit logs in enterprise business applications, in this work we explore the design space of blockchain-driven secure and transparent audit logs. We highlight the possibility of ensuring stronger security and functional properties by a generic blockchain system for audit logs, realize this generic design through BlockAudit, which addresses both security and functional requirements, optimize BlockAudit through multi-layered design in BlockTrail, and explore the design space further by assessing the functional and security properties the consensus algorithms through comprehensive evaluations. The first component of this work is BlockAudit, a design blueprint that enumerates structural, functional, and security requirements for blockchain-based audit logs. BlockAudit uses a consensus-driven approach to replicate audit logs across multiple application peers to prevent the single-point-of-failure. BlockAudit also uses the Practical Byzantine Fault Tolerance (PBFT) protocol to achieve consensus over the state of the audit log data. We evaluate the performance of BlockAudit using event-driven simulations, abstracted from IBM Hyperledger. Through the performance evaluation of BlockAudit, we pinpoint a need for high scalability and high throughput. We achieve those requirements by exploring various design optimizations to the flat structure of BlockAudit inspired by real-world application characteristics. Namely, enterprise business applications often operate across non-overlapping geographical hierarchies including cities, counties, states, and federations. Leveraging that, we applied a similar transformation to BlockAudit to fragment the flat blockchain system into layers of codependent hierarchies, capable of processing transactions in parallel. Our hierarchical design, called BlockTrail, reduced the storage and search complexity for blockchains substantially while increasing the throughput and scalability of the audit log system. We prototyped BlockTrail on a custom-built blockchain simulator and analyzed its performance under varying transactions and network sizes demonstrating its advantages over BlockAudit. A recurring limitation in both BlockAudit and BlockTrail is the use of the PBFT consensus protocol, which has high complexity and low scalability features. Moreover, the performance of our proposed designs was only evaluated in computer simulations, which sidestepped the complexities of the real-world blockchain system. To address those shortcomings, we created a generic cloud-based blockchain testbed capable of executing five well-known consensus algorithms including Proof-of-Work, Proof-of-Stake, Proof-of-Elapsed Time, Clique, and PBFT. For each consensus protocol, we instrumented our auditing system with various benchmarks to measure the latency, throughput, and scalability, highlighting the trade-off between the different protocols.
Currently, a large range of opinions exists regarding the appropriate classification and regulation of cryptocurrency. From the legal perspective, some suggest that cryptocurrency investments are too speculative. As a result of this, it is suggested that cryptocurrency should be more heavily regulated. This would be done to prevent speculators from losing vast wealth. Other legal analysts suggest that an increasing cryptocurrency regulation would have a detrimental effect on the state of cryptocurrency, and its use would cause long-term problems. From the accounting perspective, opinions vary. Some suggest an accounting classification that would make cryptocurrency cash equivalents; others suggest an accounting classification that would render cryptocurrency an intangible asset with an indefinite useful life. The âbig 4â accounting firms that include Deloitte, PricewaterhouseCoopers, Ernst and Young, and KPMG recommend that cryptocurrency should be classified as an intangible asset with an indefinite useful life. However, other companies currently using cryptocurrency through the general operations of the business have decided to classify it differently. The legal perspectives and the accounting perspectives will be analyzed to determine appropriate regulations for cryptocurrency and an appropriate classification for cryptocurrency. The results will show that cryptocurrency should be classified as an intangible asset with an indefinite useful life for accounting purposes and as property for tax purposes.
We investigate similarities and differences between stock and cryptocurrency networks obtained from log-return and volatility time series. We constructed correlation and Fast Fourier Transform based graphs and minimum spanning trees from a set of 100 highly capitalized cryptocurrencies and 100 highly capitalized NASDAQ stocks over a time window of fixed length. Our analysis is based on comparison between both economies in terms of network properties. We also examined distributions of node degrees and edge weights. Our results show that cryptocurrencies and companies with high capitalization tend to correspond to central and densely connected nodes. Network topologies for both economies and node degree distributions are rather similar. Nevertheless, the crypto-economy is more correlated and more strongly linked to important nodes, unlike the graphs of NASDAQ stocks, where we observed clusters of nodes having small dissimilarities.
Globalisation of the world economy and computarisation of financial systems form a new branch - economy. There appear some alternative currencies generated by computarisation of financial systems. A remarkable example of this process is
Abstract Combatting criminal misuse of cryptocurrencies was at the core of the fatf agenda under the US Presidency, culminating in June 2019 with the thorough extension of international standards against money laundering over virtual assetsâ markets. This echoed the first legislative measure regulating virtual currencies adopted by the EU a year before. Directive 2018/843, better known as the 5 th Anti-Money Laundering Directive, fails however to address key technological breakthroughs and new business models, which continuously make the ever-growing and fast-paced crypto economy evolve. Against this background, the present contribution investigates shortfalls and challenges that lay ahead in the light of the new fatf Recommendations. It ultimately argues that the preventive anti-money laundering measures cannot dispense with the establishment of a cross-border integrated supervisory and enforcement system.
Proof-of-burn has been used as a mechanism to destroy cryptocurrency in a verifiable manner. Despite its well known use, the mechanism has not been previously formally studied as a primitive. In this paper, we put forth the first cryptographic definition of what a proof-of-burn protocol is. It consists of two functions: First, a function which generates a cryptocurrency address. When a user sends money to this address, the money is irrevocably destroyed. Second, a verification function which checks that an address is really unspendable. We propose the following properties for burn protocols. Unspendability, which mandates that an address which verifies correctly as a burn address cannot be used for spending; binding, which allows associating metadata with a particular burn; and uncensorability, which mandates that a burn address is indistinguishable from a regular cryptocurrency address. Our definition captures all previously known proof-of-burn protocols. Next, we design a novel construction for burning which is simple and flexible, making it compatible with all existing popular cryptocurrencies. We prove our scheme is secure in the Random Oracle model. We explore the application of destroying value in a legacy cryptocurrency to bootstrap a new one. The user burns coins in the source blockchain and subsequently creates a proof-of-burn, a short string proving that the burn took place, which she then submits to the destination blockchain to be rewarded with a corresponding amount. The user can use a standard wallet to conduct the burn without requiring specialized software, making our scheme user friendly. We propose burn verification mechanisms with different security guarantees, noting that the target blockchain miners do not necessarily need to monitor the source blockchain. Finally, we implement the verification of Bitcoin burns as an Ethereum smart contract and experimentally measure that the gas costs needed for verification are as low as standard Bitcoin transaction fees, illustrating that our scheme is practical.
This paper presents a blockchain enabled secure data acquisition scheme utilizing an unmanned aerial vehicle (UAV) swarm where data are collected from the Internet of Things (IoT) devices and subsequently, forwarded to the nearest server through the UAV swarm. Before initiating data acquisition, the UAV swarm shares a shared key with the IoT devices in order to maintain communications. However, prior to transmitting data, the IoT devices encrypt the data and forward it to the UAV swarm. Upon receiving the data, the UAV swarm implements a two-phase validation utilizing the Ď-hash bloom filter and the digital signature algorithm to validate the sender; in addition, prior to forwarding data to the nearest server, it performs encryption. However, before adding data in blockchain, consent from all validators is required. Finally, the data are stored in blockchain with the approval of validators. A security analysis is performed to demonstrate the feasibility of the proposed scheme. Finally, the effectiveness of the proposed scheme is manifested through the implementation and simulation. The security analysis and the performance results show that UAV assist the IoT devices both in terms of connectivity and energy consumption, and provides security against the threats mentioned in the paper.
Stefanos Malliaros, Christos Xenakis, George Moldovan, John Mantas ¡ 6 authors
INTRODUCTION: Individuals and healthcare providers need to trust that the EHRs are protected and that the confidentiality of their personal information is not at stake. AIM: Within CrowdHEALTH project, a security and privacy framework that ensures confidentiality, integrity, and availability of the data was developed. METHODS: The CrowdHEALTH Security and Privacy framework includes Privacy Enhancing Technologies (PETs) in order to comply with the GDPR EU laws of data protection. CrowdHEALTH deploys OpenID Connect, an authentication protocol to provide flexibility, scalability, and lightweight user authentication as well as the attribute-base access control (ABAC) mechanism which supports creating efficient access control policies. RESULTS: CrowdHEALTH integrates ABAC with OpenID Connect to build an effective and scalable base for end-users' authorization. CrowdHEALTH's security and privacy framework interacts with other CrowdHEALTH's components, for instance the Big Data Platform, that depends on user authentication and authorization. CrowdHEALTH users are able to access the CrowdHEALTH's database based on the result of an ABAC request. Moreover, due to the fact that the CrowdHEALTH system requires proofs during the interactions with data producers of low trust or low reputation level, the requirements for the Trust and Reputation Model have been identified. CONCLUSION: The CrowdHEALTH Integrated Holistic Security and Privacy framework meets the security criteria for an e-health cross-border system, due to the adoption of security mechanisms, such as user authentication, user authorization, access control, data anonymization, trust management and reputation modelling. The implemented framework remains to be tested to ensure its robustness and to evaluate its performance. The holistic security and privacy framework might be adapted during the project's life circle according to new legislations.
This article explores four critical groups of systematic risk embedded in smart contract employment using the analytic hierarchy process (AHP). The four principal risk analysis groups include: 1) transparency in the light of corporate governance 2) IT security 3) contract management automation and 4) legality. The AHP assists both decision-makers and stakeholders alike in the evaluation process essential for identifying potential technological constraints posed within a permissioned blockchain environment using peer-to-peer format in the absence of digital currency. Based upon critical assessment, the AHP methodology enables pairwise comparisons among different features and consequently increases the knowledge regarding these attributes in light of the softwareâs risk assessment.
Anonymity revocation is an essential component of credential issuing systems since unconditional anonymity is incompatible with pursuing and sanctioning credential misuse. However, current anonymity revocation approaches have shortcomings with respect to the auditability of the revocation process. In this paper, we propose a novel anonymity revocation approach based on privacy-preserving blockchain-based smart contracts, where the code self-execution property ensures availability and public ledger immutability provides auditability. We describe an instantiation of this approach, provide an implementation thereof and conduct a series of evaluations in terms of running time, gas cost and latency. The results show that our scheme is feasible and efficient.